{"id":4157,"date":"2026-08-20T00:44:49","date_gmt":"2026-08-19T22:44:49","guid":{"rendered":"https:\/\/www.lablogic.pl\/?page_id=4157"},"modified":"2026-08-20T14:16:19","modified_gmt":"2026-08-20T12:16:19","slug":"michal-rutkowski","status":"publish","type":"page","link":"https:\/\/www.lablogic.pl\/en\/michal-rutkowski\/","title":{"rendered":"Micha\u0142 Rutkowski \u2014 DPO, GDPR and NIS2 expert"},"content":{"rendered":"
\n\t\n
\n\t\n\n
\n
\n\t\n\n

EXPERT AND AUTHOR<\/p>\n\n\n\n

Micha\u0142 Rutkowski \u2014 DPO, GDPR, NIS2 and cybersecurity<\/h1>\n\n\n\n

Since 2004 I have worked at the intersection of technology, data protection and risk management. I act as an external DPO, run GDPR audits, prepare organizations for NIS2 and the Polish KSC Act, support them during incidents and breaches, and train management boards and teams. <\/p>\n\n\n\n

\n
Schedule a diagnostic conversation<\/a><\/div>\n<\/div>\n\n\n\n

Over 20 years of experience \u2022 data protection, technology, and risk management \u2022 cooperation in Polish and English<\/p>\n\n\n

\n\t\n
\n\t\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n
\n\t\n\n

Direct contact with an expert<\/p>\n\n\n\n

A brief answer and a clear recommendation for the next step.<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n<\/div>\n\n\n\n

\n\t\n\n
\"Micha\u0142<\/figure>\n\n<\/div>\n<\/div>\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n
\n\t\n
\n\t\n\n

Experience and how I work<\/h2>\n\n\n\n

I am a data protection and cybersecurity practitioner and the owner of LabLogic. I work with medium and large organizations, including the financial sector and other regulated industries. I combine the legal, organizational and technological perspective: support for and fulfilment of the DPO role, preparation for NIS2 and the Polish KSC Act, incident response, audits and training.<\/p>\n\n\n\n

\n
\n\t\n
\n\t\n\n

Over 20 years of technological experience<\/h3>\n\n<\/div>\n\n\n\n

Practical experience working with systems, processes, vendors, and real organizational problems.<\/p>\n\n<\/div>\n<\/div>\n\n\n\n

\n\t\n
\n\t\n\n

Audits and practice in breach handling<\/h3>\n\n<\/div>\n\n\n\n

Recommendations result from the analysis of events, projects, and the organization’s mode of operation.<\/p>\n\n<\/div>\n<\/div>\n\n\n\n

\n\t\n
\n\t\n\n

Support for complex organizations<\/h3>\n\n<\/div>\n\n\n\n

Communication tailored to the management board and cooperation with legal, compliance, HR, and IT.<\/p>\n\n<\/div>\n<\/div>\n\n\n\n

\n\t\n
\n\t\n\n

Polish and English<\/h3>\n\n<\/div>\n\n\n\n

Ability to work with documentation, teams, and stakeholders in both languages.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n

\n\t\n
\n\t\n\n

Areas where I can help<\/h2>\n\n\n\n

Choose the area that matches your organization\u2019s situation.<\/p>\n\n\n\n

\n
\n\t\n
\n\t\n\n

DPO and GDPR<\/h3>\n\n<\/div>\n\n\n\n

External DPO, support for your current officer, GDPR audit and ongoing advice for the board and teams.<\/p>\n\n\n\n

\n
Learn about the service<\/a><\/div>\n<\/div>\n\n<\/div>\n<\/div>\n\n\n\n
\n\t\n
\n\t\n\n

NIS2 and KSC<\/h3>\n\n<\/div>\n\n\n\n

Entity qualification, gap and risk analysis, a plan and support for implementation and audit readiness.<\/p>\n\n\n\n

\n
Learn about the service<\/a><\/div>\n<\/div>\n\n<\/div>\n<\/div>\n\n\n\n
\n\t\n
\n\t\n\n

Incidents and breaches<\/h3>\n\n<\/div>\n\n\n\n

Situation and risk assessment, notification decisions, communication and remedial actions.<\/p>\n\n\n\n

\n
Learn about the service<\/a><\/div>\n<\/div>\n\n<\/div>\n<\/div>\n\n\n\n
\n\t\n
\n\t\n\n

Training and workshops<\/h3>\n\n<\/div>\n\n\n\n

Practical GDPR and NIS2 training for boards, senior staff and IT and compliance teams.<\/p>\n\n\n\n

\n
Learn about the service<\/a><\/div>\n<\/div>\n\n<\/div>\n<\/div>\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n
\n\t\n
\n\t\n\n

Knowledge and insights<\/h2>\n\n\n\n

I publish current analyses and explanations in the LabLogic Knowledge Base<\/a>. Choose the category that matches the question your organization is facing.<\/p>\n\n\n\n

\n
\n\t\n
\n\t\n\n

DPO and GDPR<\/h3>\n\n<\/div>\n\n\n\n

When a data protection officer has to be appointed, how the role works with the management board and what day-to-day GDPR practice requires.<\/p>\n\n\n\n

\n
See articles<\/a><\/div>\n<\/div>\n\n<\/div>\n<\/div>\n\n\n\n
\n\t\n
\n\t\n\n

NIS2 and KSC<\/h3>\n\n<\/div>\n\n\n\n

Whether your organization falls under the new rules, how to read the result of a gap analysis and where to start the preparations.<\/p>\n\n\n\n

\n
See articles<\/a><\/div>\n<\/div>\n\n<\/div>\n<\/div>\n\n\n\n
\n\t\n
\n\t\n\n

Incidents and breaches<\/h3>\n\n<\/div>\n\n\n\n

How an incident differs from a personal data breach, when the duty to notify arises and what the breach register has to contain.<\/p>\n\n\n\n

\n
See articles<\/a><\/div>\n<\/div>\n\n<\/div>\n<\/div>\n\n\n\n
\n\t\n
\n\t\n\n

Training and workshops<\/h3>\n\n<\/div>\n\n\n\n

Who to train and how often, what the management board should expect from a session and how to measure its effectiveness.<\/p>\n\n\n\n

\n
See articles<\/a><\/div>\n<\/div>\n\n<\/div>\n<\/div>\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n
\n\t\n
\n\t\n\n

Latest publications<\/h2>\n\n\n\n

The newest explanations and analyses from the LabLogic Knowledge Base.<\/p>\n\n\n

\n\t\n\n
\n\t\t\t
\n\t\t\t
\n
\n\t\n
\"Who<\/a><\/figure>\n\n
Training and workshops<\/a><\/div>\n\n

Who else needs NIS2 training besides the management board?<\/a><\/h3>\n\n

The KSC Act names only the head of the entity and the person entrusted with their…<\/p>

Read article<\/a><\/p><\/div>\n<\/div>\n\n<\/div>

\n
\n\t\n
\"What<\/a><\/figure>\n\n
Incidents and Breaches<\/a><\/div>\n\n

What should a personal data breach register contain?<\/a><\/h3>\n\n

Article 33(5) GDPR requires documentation, not a register in a prescribed form. The documentation has to…<\/p>

Read article<\/a><\/p><\/div>\n<\/div>\n\n<\/div>

\n
\n\t\n
\"When<\/a><\/figure>\n\n
NIS2 and KSC<\/a><\/div>\n\n

When and how to apply for entry in the KSC register?<\/a><\/h3>\n\n

The deadline depends on the day the conditions were met. Entities that met them on 3…<\/p>

Read article<\/a><\/p><\/div>\n<\/div>\n\n<\/div>

\n
\n\t\n
\"External<\/a><\/figure>\n\n
DPO and GDPR<\/a><\/div>\n\n

External or internal DPO? What to consider before deciding?<\/a><\/h3>\n\n

The regulation allows both models and holds them to the same requirements. The choice is not…<\/p>

Read article<\/a><\/p><\/div>\n<\/div>\n\n<\/div>

\n
\n\t\n
\"How<\/a><\/figure>\n\n
Training and workshops<\/a><\/div>\n\n

How do you know that training produced a real effect?<\/a><\/h3>\n\n

Attendance and a final test describe how the training went, not its effect. The effect shows…<\/p>

Read article<\/a><\/p><\/div>\n<\/div>\n\n<\/div>

\n
\n\t\n
\"Cybersecurity<\/a><\/figure>\n\n
Incidents and Breaches<\/a><\/div>\n\n

Cybersecurity incident vs personal data breach: what is the difference?<\/a><\/h3>\n\n

An incident under the Polish KSC act and a breach under the GDPR are two independent…<\/p>

Read article<\/a><\/p><\/div>\n<\/div>\n\n<\/div>

\n
\n\t\n
\"What<\/a><\/figure>\n\n
NIS2 and KSC<\/a><\/div>\n\n

What should a NIS2 gap analysis contain?<\/a><\/h3>\n\n

A gap analysis has to let the board take three decisions: what the organisation must meet,…<\/p>

Read article<\/a><\/p><\/div>\n<\/div>\n\n<\/div>

\n
\n\t\n
\"Where<\/a><\/figure>\n\n
NIS2 and KSC<\/a><\/div>\n\n

Where should the board begin preparing for NIS2?<\/a><\/h3>\n\n

With two board decisions: who is the entity manager within the meaning of the KSC Act,…<\/p>

Read article<\/a><\/p><\/div>\n<\/div>\n\n<\/div>

\n
\n\t\n
\"How<\/a><\/figure>\n\n
DPO and GDPR<\/a>, <\/span>Training and workshops<\/a><\/div>\n\n

How often should employees be trained on data protection?<\/a><\/h3>\n\n

The GDPR does not specify training frequency. The rhythm is set by changes in processes, staff…<\/p>

Read article<\/a><\/p><\/div>\n<\/div>\n\n<\/div>\t\t<\/div>\n\t<\/div>\n\n\t\t\t

\n\t\t\tPrevious slide<\/span>\n\t\t\t\t\t\t<\/path><\/svg>\n\t\t\t\t\t<\/div>\n\t\t
\n\t\t\tNext slide<\/span>\n\t\t\t\t\t\t<\/path><\/svg>\n\t\t\t\t\t<\/div>\n\t\n\t\t\t
<\/div>\n\t\n\n\n\t<\/div>\n\n\n<\/div>\n\n<\/section>\n\n\n
\n\t\n
\n\t\n\n
\n
\n\t\n\n

DIAGNOSTIC CONVERSATION<\/p>\n\n\n\n

Let’s start with a conversation about your organization’s needs<\/h2>\n\n\n\n

We will determine whether the appropriate first step will be an audit, formal fulfillment of the DPO function, ongoing expert support, or assistance with a breach.<\/p>\n\n<\/div>\n<\/div>\n\n\n\n

\n\t\n\n

Briefly describe your situation<\/h3>\n\n\n